Role in IT decision-making process:Align Business & IT GoalsCreate IT StrategyDetermine IT NeedsManage Vendor RelationshipsEvaluate/Specify Brands or VendorsOther RoleAuthorize PurchasesNot Involved

Work Phone:

Company:

Company Size:

Industry:

Street Address

City:

Zip/postal code

State/Province:

Country:

Occasionally, we send subscribers special offers from select partners. Would you like to receive these special partner offers via e-mail?YesNo

Your registration with Eweek will include the following free email newsletter(s):News & Views

By submitting your wireless number, you agree that eWEEK, its related properties, and vendor partners providing content you view may contact you using contact center technology. Your consent is not required to view content or use site features.

By clicking on the "Register" button below, I agree that I have carefully read the Terms of Service and the Privacy Policy and I agree to be legally bound by all such terms.

WEBINAR:On-Demand

My first reaction after reading accounts about the breach of a vast trove of financial and related information from the Panamanian law firm Mossack Fonseca was to channel John Le Carré and his famed Panamanian tailor/spy Harry Pendel.

However, the reality is much less interesting. The story is actually about a company with third-rate security that gets exploited by a routine hack.

While the details of the attack on Mossack Fonseca haven't been fully revealed, and while there's a great deal of hay being made by newspapers reporting details about prominent people who have offshore financial accounts, the really important story is about what was'’t in the breach. And no, I'm not talking about the puzzling lack of involvement by Americans. What's clearly lacking is even the most basic attempt at protecting the firm's client data.

The firm’s founding partner, Ramon Fonseca, has revealed in an interview with Reuters that the attack that allowed hackers to make off with something over two terabytes of sensitive scans and images along with other information was an external hack. He said that this was not an inside job. That's a surprising confession made only a couple of days after the hack was discovered and after the contents of the firm's files were published far and wide in newspapers and on Websites.

Further reading

So what really happened? Security experts I've talked to tell me that Mossack Fonseca was almost certainly the victim of a spear-phishing attack, with an email that released malware that opened up access to the firm's network. That would make Fonseca's statement correct, since it doesn't appear that an insider knowingly unleashed the malware or emailed the data to co-conspirators.

But here's where it gets tricky. Even if the attack came from outside, the information on who to target in the attack had to come from somewhere. The fact that the entire digital assets of the firm appear to have been laid bare would indicate that the target had to be someone very senior in the firm, or that the firm simply allowed any employee to look at anything on its servers. So where did the information on employees with privileged access come from?

The chances are very good that the critical information came from inside the firm, perhaps unwittingly. The names of some of the lawyers at the firm can be found on the company's Website with minimal effort. The names of the principals are public, but which of these people to attack? A list of partners with their email addresses could be all that was needed.

Well placed emails were all that was required to carry out the recent spate of CEO spear-phishing attacks that have recently struck companies of all sizes. A senior person at a company gets an email with a plausible request for information that seems to be from someone they know.

By submitting your information, you agree that eweek.com may send you eWEEK offers via email, phone and text message, as well as email offers about other products and services that eWEEK believes may be of interest to you. eWEEK will process your information in accordance with the Quinstreet Privacy Policy.

We ran into a problem

We already have your email address on file. Please use the "Forgot your password?" link to create a password, validate your email and login.